Explorar o código

drm/nouveau: fix i2ctable bounds checking

i2c_entries seems to be the number of i2c entries,
so with index equal to this number, we could read
invalid data from i2ctable. Fix it.

Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Francisco Jerez <currojerez@riseup.net>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Marcin Slusarz %!s(int64=15) %!d(string=hai) anos
pai
achega
761c5a6975
Modificáronse 1 ficheiros con 4 adicións e 3 borrados
  1. 4 3
      drivers/gpu/drm/nouveau/nouveau_bios.c

+ 4 - 3
drivers/gpu/drm/nouveau/nouveau_bios.c

@@ -4984,7 +4984,8 @@ read_dcb_i2c_entry(struct drm_device *dev, int dcb_version, uint8_t *i2ctable, i
 		else
 		else
 			NV_WARN(dev,
 			NV_WARN(dev,
 				"DCB I2C table has more entries than indexable "
 				"DCB I2C table has more entries than indexable "
-				"(%d entries, max index 15)\n", i2ctable[2]);
+				"(%d entries, max %d)\n", i2ctable[2],
+				DCB_MAX_NUM_I2C_ENTRIES);
 		entry_len = i2ctable[3];
 		entry_len = i2ctable[3];
 		/* [4] is i2c_default_indices, read in parse_dcb_table() */
 		/* [4] is i2c_default_indices, read in parse_dcb_table() */
 	}
 	}
@@ -5000,8 +5001,8 @@ read_dcb_i2c_entry(struct drm_device *dev, int dcb_version, uint8_t *i2ctable, i
 
 
 	if (index == 0xf)
 	if (index == 0xf)
 		return 0;
 		return 0;
-	if (index > i2c_entries) {
-		NV_ERROR(dev, "DCB I2C index too big (%d > %d)\n",
+	if (index >= i2c_entries) {
+		NV_ERROR(dev, "DCB I2C index too big (%d >= %d)\n",
 			 index, i2ctable[2]);
 			 index, i2ctable[2]);
 		return -ENOENT;
 		return -ENOENT;
 	}
 	}